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This module should be read in conjunction with the Introduction and with the 
Glossary, which contains an explanation of abbreviations and other terms used in 
this Manual. If reading on-line, click on blue underlined headings to activate 
hyperlinks to the relevant module. 


Purpose 


To provide guidance in respect of the reporting obligations of Als’ external 
auditors under the Banking Ordinance 


Classification 
A non-statutory guideline issued by the MA as a guidance note 


Previous guidelines superseded 


Guideline 9.1 "Banking Ordinance: Auditors and Reporting under 
Section 61 to the Commissioner of Banking" dated 31.12.90; Guideline 
9.2 "Auditors’ Certificates on Statistical Returns" dated 23.07.91; and 
Guideline 9.3 "Internal Control Systems" dated 15.08.92; and_ |C-3 


“Reporting Requirements Relating to Authorized Institutions’ External 
Auditors under the Banking Ordinance” (V.1) dated 06.11.2003 





Application 


To all Als (parts applicable only to locally incorporated Als are stated as 
such) 


Structure 
1. Introduction 
1.1 Background 
1.2 Role of the auditors 


1.3 Role of Als’ audit committees 
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1.4 Legal framework 


2. Appointment, removal and resignation of auditors 
2.1 Appointment 
2.2 Removal 
2.3 Resignation 
3. Auditors’ reporting on banking returns 
3.1 Purpose and coverage 
3.2 Reporting frequency and timing 
3.3 Criteria for reporting errors 
4. Auditors’ reporting on various internal control systems 
4.1 General 
4.2 Annual reviews 
4.3 Ad hoc reviews 
5. Auditors’ reporting on certain specified matters 
5.1 Reporting of significant adverse matters 
5.2 Reporting of non-compliance with the SFO 
6. Communication between the auditors and the HKMA 
6.1 Protection 
6.2 Direct reporting to the HKMA 
6.3 Sharing of information with auditors 
6.4 Tripartite meeting 
7. Industry guidance 
Annex A: Supervisory expectations relevant to the external audits 
and the auditors 
AB: Controls relating to the compilation of banking returns 
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BC: Controls relating to compliance with statutory provisions 
in the Banking Ordinance 


GD: Controls relating to the maintenance of adequate provisions 











fre 


/ D D _ Honc Konc MONETARY AUTHORITY 
EERE 





Supervisory Policy Manual 




















IC-3 Reporting Requirements Relating to V.+2— 
Authorized Institutions’ External oo 
Auditors under the Banking Ordinance 
1. Introduction 


1.1 Background 


1.1.1 


External auditors (hereinafter referred to as “the auditors”) 
play an important role in the supervisory process. The Basel 
Committee on Banking Supervision recognises the 
importance of the use of auditors in its Core Principles for 
Effective Banking Supervision. Principles +9-10 and 24-27 
relate to the use of auditors to: 


° help ensure that each bank maintains adequate_and 
reliable records—drawn—up_as well as prepares 
financial statements in accordance with censistent 
accounting policies and practices_that_are widely 


accepted internationally. This enables the 
supervisors to obtain a true and fair view of the banks’ 


financial condition and preftablityperformance; and 


e perform independent checking to ensure the validity 
and integrity of the supervisory information. 


1.2 Role of the auditors 


24 


The key responsibility of a bank’s auditors is to express an 
Opinion as to whether the bank’s financial statements give a 
true and fair view and have been prepared in accordance 
with generally accepted accounting principles. In Hong 
Kong, the auditors are required to conduct the audit in 
accordance with applicable Statements—ef—Auditing 
StandardsStandards on Auditing issued by the Hong Kong 
Seciehy—_ot_Accountanitsinstitute of Certified Public 
Accountants (“HKSAHKICPA”), including adequate planning 
and supervision. The auditors are also required to observe 
the ethical standards promulgated by the HKSAHKICPA, 
including those calling for independence, objectivity, 
professional competence and due care. 


4+2-41.2.2 In particular, Als’ auditors should comply with the 


partner rotation requirements applicable to the audits of 
4 
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public interest entities as set out in the HKICPA’s Code of 
Ethics for Public Accountants (“COE”). In respect of the 


audit of an Al (including financial statements audit and 


auditors’ reporting for prudential purposes), an_ individual 
shall not_act_in any of the key audit partner: roles, or a 
combination of such roles, for a period of more than seven 
cumulative years. The individual should also abide by the 
COE’s requirements on the cooling-off period and the 
activities restrictions during the cooling-off period. 


+221.2.3 Apart from this-the responsibility_to express an opinion 
on the bank’s financial statements, the auditors may 
communicate with those charged with governance? of the 
bank (e.g. through a management letter) any material 
weaknesses identified in its internal control system during 
the course of the audit and provide recommendations for 
improvement. 


1.2.4 The auditors may also be required to report on certain 
specified events or make regular reports to the supervisors 
in addition to the audit report on the bank’s financial 
statements. Generally, the scope of such reports will be 
agreed by the regulator, the bank concerned and its 
auditors before the commencement of the review. 


+231.2.5 See Annex A for other supervisory expectations relevant 
to the external audits (including financial statements audits 


and auditors’ reporting for prudential purposes) and the 
auditors. 








: Key audit partner is defined in the HKICPA’s COE as the engagement partner, the individual responsible for the 
engagement quality control review, and other audit partners, if any, on the engagement team who make key 
decisions or judgments on significant matters with respect to the audit of the financial statements on which the 
firm will express an opinion. Depending upon the circumstances and the role of the individuals on the audit, 
“other audit partners” might include, for example, audit partners responsible for significant subsidiaries or 
divisions. 
? The partner rotation requirements are expected to be adopted for financial years ending on or after 
1 January 2021 if they are not currently applied by the Als’ auditors. 

For the purposes of this module, the term “those charged with governance” refers to the audit committee and/or 
relevant governing body of the Al as appropriate. 
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1.3 Role of Als’ audit committees 


1.3.1 The overall roles _and _responsibilities of an Al’s audit 
committee with respect to the external audits and the 
auditors have been set out in CG-1 “Corporate governance of 
locally incorporated authorized institutions” and IC-2 “Internal 
audit function”. Further guidance is provided below on the 
audit committee’s responsibilities in relation to the oversight 
of as well as its relationship with the auditors.” 


1.3.2 The audit committee should seek from the auditors, at least 
on an annual basis, information about the audit firm’s policies 
and processes for maintaining independence and monitoring 
compliance with the relevant requirements. 


1.3.3 The audit committee of an Al should develop a formal policy 
which governs the engagement of auditors for non-audit 
services” provided by auditors within the applicable ethical 
standards and regulatory requirements for auditors. Amongst 
other provisions, the policy should include criteria for the 
types of non-audit services that the auditors may provide or 
are prohibited from providing, and rules stipulating when 
advance approval by the audit committee is required for the 
engagement of auditors for non-audit services. The policy 


should be reviewed periodically and compliance should be 
monitored. 





1.3.4 The audit committee of an Al should discuss with the auditors 


any significant issues identified in the course of the audits as 
well as the areas which could be relevant to future financial 
statements to promote early discussion and planning. These 
include upcoming changes in accounting standards or 
regulations and the implications of material transactions for 


the financial reporting processes and performance of the 
bank. 





4 In the case of an overseas incorporated Al which does not have an audit committee at the branch level, there 
should be a process for monitoring and assessing the effectiveness of the external audits as well as the 
independence of the auditors. Certain oversight function might be centralised at the group or regional level. 
Non-audit services include those services provided by the consultancy or advisory set-ups associated with the 
auditors. 
6 
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1.3.5 The audit committee should also communicate to the 


auditors matters that are likely to be of significant relevance 
to the conduct of the audits. Such matters may encompass 
subjects that the audit committee believes warrant particular 
attention or may influence the audits, including significant 
communications with the supervisor. 


1.3.6 In order to reinforce the audit committee’s effectiveness and 


enhance the quality of the external audits, the audit 
committee should consider 


e inviting the auditors to attend audit committee 
meetings (except when discussing matters in relation 
to the assessment of the auditors), even if there are 
no items explicitly relevant to the external audits on 
the agenda. The auditors’ attendance should facilitate 
the exchange of views on the bank’s business 
performance, risk and other topics; and 


° assisting the auditors, if necessary, to gain access to 


any _other committee meetings that the auditors 
determine to be relevant for the auditors’ work. 


1.3.7 To enable the audit committee to understand and discuss all 


issues that may have arisen between the auditors and bank 
management in the course of the external audits and how 
these issues have been resolved, the audit committee should 
consider meeting regularly with the auditors in the absence of 
executive management. In addition, these meetings should 
address any other matters that the auditors believe the audit 
committee should be aware of in order to exercise its 


responsibilities. 





4.31.4 Legal framework 


4+.341.4.1 Companies incorporated under the Companies 
Ordinance (including locally incorporated Als) are required to 
appoint auditors at each annual general meeting of the 
company. Pursuant to §+44+406 of the Companies Ordinance, 
the auditors are required to examine the aceeunts—financial 
statements of the company and to report to the shareholders 


7 











VV FESE 





Supervisory Policy Manual 





IC-3 Reporting Requirements Relating to V.+2-— 
Authorized Institutions’ External ee ae NA 


Auditors under the Banking Ordinance 

















of the company on whether, in their opinion, the acceunts 
financial statements give a true and fair view of the 
cempanys_tinancial position_and financial performance of the 
company and have been properly prepared in accordance 
with the provisions of the Companies Ordinance. 


1.4.2 Under §59(1) of the Banking Ordinance, every Al and its 
auditors shall comply with the Companies Ordinance with 
respect to the audit of a company’s acéceuntsfinancial 
statements, whether or not the Al is incorporated under that 
Ordinance’.4 Locally incorporated Als should submit their 
annual report (including —a set of audited annual 
accountsfinancial statements, an auditors’ report and a 
directors’ report) to the MA within four months after the 
close of each financial year (for overseas incorporated Als 
the time limit is six months). 


4+.3.21.4.3 Set out below is a summary of the auditors’ major duties 
and responsibilities in relation to prudential supervision 
under the Banking Ordinance: 


° Reporting on banking returns 


- Pursuant to §63(3) of the Banking Ordinance, 
Als can be required to appoint auditors to 
report, normally once a year, on whether a 
return or information submitted by them is 
correctly compiled, in all material respects, 
from their books and records and, if not, the 
nature and extent of the incorrectness (see 
section 3 below). 


- Under §50(1)(c) of the Banking Ordinance, 
locally incorporated Als which maintain an 
overseas branch may need to appoint auditors, 
if the MA so requires, to report on whether a 





ê Under §2 of the Banking Ordinance, an “auditor” means a certified public accountant (practising) as defined in 
the Professional Accountants Ordinance. 

7 Under §60(6) of the Banking Ordinance, the MA may by notice in writing exempt an Al to comply with §59(1). 
Normally this exemption will be granted on an annual sat and only to overseas incorporated Als. 











(Aip\ Honc Konc Monetary AUTHORITY 
J Bree E 


Í 








Supervisory Policy Manual 





IC-3 





Reporting Requirements Relating to hag, 
Authorized Institutions’ External ation 
Auditors under the Banking Ordinance 





0644-93Consult 











return or information submitted by them in 
respect of their overseas branch(es) is 
correctly compiled, in all material respects, 
from the books and records of the branch(es). 


Reporting on systems of control over the 
compilation of returns 


§63(3A) of the Banking Ordinance allows the MA to 
require Als to appoint auditors to report, normally 
once a year, on the adequacy of their systems of 
control over the compilation of banking returns or 
other information, compliance with certain statutory 
provisions in the Ordinance and, in the case of locally 
incorporated Als, the maintenance of adequate 
provisions (See subsection 4.2 below). 


Reporting on specific systems of control 


Under §59(2) of the Banking Ordinance, Als may be 
required to appoint the auditors, normally on a needs 
basis, to report on (see subsection 4.3 below): 


- their state of affairs or profit and loss or both; 
or 


- the adequacy of specific systems of control. 
Reporting of qualification or adverse statement 


Under §59A(2)(c) of the Banking Ordinance, Als’ 
auditors appointed under §4+34-395, 396, 397 or 398 
of the Companies Ordinance are required to provide 
immediate written notice to the MA if they decide to 
include in their report on an Al’s acceunts—financial 
statements any qualification or adverse statement as 
to a matter mentioned in §44+-406 or 407 of the 
Companies Ordinance. 





Reporting of significant adverse matters and non- 
compliance cases 


§§63A and 63B of the Banking Ordinance require Als’ 
9 
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auditors to submit a report to the MA if, in the course 
of performing their duties as auditors, they become 
aware of any matter that in their opinion: 


- adversely affects an Al’s financial position to a 
material extent (see subsection 5.1 below); or 


- constitutes on the part of a registered Al% a 
failure to comply with certain provisions or 
rules made under the Securities and Futures 
Ordinance (“SFO”) (see subsection 5.2 below). 


+3-31.4.4 To facilitate a direct dialogue between Als’ auditors and 
the MA, there are protection clauses in the Banking 
Ordinance: 


«—§61 of the Banking Ordinance protects the auditors, 
despite any duty which they may owe to their clients 
(e.g. confidentiality), where they communicate to the 
MA in good faith any information or opinion on a 
matter of which they become aware in their capacity 
as auditors and which is relevant to any function of 
the MA under the Ordinance (see subsection 6.1 
below); and 





° §120(5)(g) of the Banking Ordinance allows the 
disclosure of information by the MA to the auditors of 
an Al or former Al, or to the former auditors, for the 
purpose of enabling or assisting the MA to discharge 
his functions under the Ordinance (see subsection 
6.3 below). 


2. Appointment, removal and resignation of auditors 


2.1 Appointment 


3A “registered Al” means an Al that is a registered institution under the SFO. 
1 
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2.1.1 Reports under §§50(1)(c), 59(2), 63(3) and 63(3A) should 
be submitted by a firm of auditors appointed by an Al and 
approved by the MA. The auditors so appointed should be: 


° the auditors appointed by the Al prior to the report 
being so required and approved by the MA for the 
purpose of preparing the report; or 


e the auditors approved or nominated by the MA for the 
purpose of preparing the report after consultation 
with the Al. 


2.1.2 The auditors referred to under §§63A and 63B of the Banking 
Ordinance (see section 5 below) are persons appointed: 


o by shareholders of a locally incorporated Al, under 
§4+34—395, 396, 397 or 398 of the Companies 
Ordinance, to report on whether the Al’s accounts 
financial statements show a true and fair view and 
have been properly drawn up in accordance with the 
provisions of that Ordinance; or 


° by the Al to submit a report to the MA under §§59(2), 
63(3) or 63(3A) of the Banking Ordinance. 


2.1.3 Accordingly the auditors for the various purposes under the 
Banking Ordinance (except §59(2) —— see para. 2.1.4 below) 
will normally be an Al’s existing auditors. The MA has the 
right, however, to commission reports from another firm of 
auditors where: 





° he considers that this arrangement can better utilise 
the knowledge and expertise of different auditors 
which may be beneficial to the Al; or 


2 he has reason to believe that the existing auditors 
would not be capable of producing an adequate 
report. In reaching this judgement, he will take into 
account: 


- the reputation of the existing auditors; 
- the quality of the reports previously submitted 


11 
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to him; 


- the expertise, knowledge and resources of the 
existing auditors; and 


- any potential conflict of interest? on the part of 
the existing auditors. 


2.1.4 Even where there are no doubts about the capability of the 
existing auditors, the MA may require that a report under 
§59(2) of the Banking Ordinance should be obtained from 


another firm of auditors, in particular if there may be any 


potential conflict of interest relating to the existing auditors. 
This would be to obtain a fresh and independent 


perspective on the matters which are the subject of the 
review. 


2.1.5 If the MA is not intending to approve the existing auditors, 
he will first consult the Al concerned. Usually the MA will 
request the Al to propose another firm of auditors for his 
approval. If the Al fails to propose a satisfactory firm within 
a specified timeframe, he will nominate a selection of 
suitable firms from which the Al will be required to choose.-. 


2.1.6 An audit firm may be appointed by Als to carry out a variety 
of assignments and these may be carried out by different 
departments of the audit firm. Auditors may therefore wish 
to consider whether reporting lines should be established 
within the firm so as to enable any important matters 
concerning clients to be brought to the attention of the 
auditors in the firm responsible for the annual audit or any 
review performed under the Banking Ordinance. 


2.1.7 _ The appointed auditors should meet the ethical and 
independence requirements set out by the internationally 
accepted ethical and independence standards (such as the 





° For the purposes of this module, a potential conflict of interest situation exists if, with all relevant facts and 
circumstances, a reasonable person would consider that the auditors may not be able to exercise unbiased 
judgement in respect of the work undertaken for prudential purposes. For example, independence concern may 
arise if the auditors are engaged to provide an assurance report on the effectiveness of the internal controls over 
certain IT systems of the Al which they were previously involved in the design and implementation of the systems. 
Overall, whether a potential conflict of interest situation exists would need to be assessed on a case-by-case 
basis. 
12 
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Code of Ethics for Professional Accountants issued by the 
International Ethics Standards Board for Accountants) and 
any additional requirements by the HKMA in relation to the 
relevant engagement. 


2.1.8 In respect of partner rotation, auditors should comply with 
the rotation requirements as mentioned in para. 1.2.2 above. 


2-4.72.1.9 Where an Al appoints a third party (i.e. other than the 
existing auditors) to review any matters relating to its assets, 
internal controls and accounting records, the MA would 
expect the Al to inform its auditors of such an appointment. 
The Al should also make available to its auditors without 
delay the reports of any such reviews. 


2.2 Removal 


2.2.1 §59A(1) of the Banking Ordinance requires a locally 
incorporated Al to notify the MA immediately if: 


° the Al proposes to give notice to its members of an 
ordinary resolution removing its auditors before the 
expiration of the term of office; 


° the Al gives notice to its members of an ordinary 
resolution replacing its auditors at the expiration of 
the term of office; or 


e a person ceases to be an auditor of the Al otherwise 
than in consequence of such a resolution. 





2 


2.3 Resignation 


2.3.1 Under §59A(2) of the Banking Ordinance, an Al’s auditors 
appointed under §395, 396, 397 or 398434 of the 
Companies Ordinance shall immediately provide a written 
notice to the MA if they: 


° resign before the expiration of the term of office; or 





° do not seek to be re-appointed. 


13 





(ap Honc Konc Monetary AUTHORITY 
Po FEER 





Supervisory Policy Manual 





IC-3 Reporting Requirements Relating to V.+2— i 
Authorized Institutions’ External peas A ia 














Auditors under the Banking Ordinance 





02.3.2 If the auditors resign or communicate an intention to resign, 
those charged with governance of the Al should follow up on 
the reasons or explanations giving rise to such resignation 
and consider any need to take actions in response to those 


reasons. 


3. Auditors’ reporting on banking returns 


3.1 Purpose and coverage 


3.1.1 The HKMA monitors Als’ financial condition and profitability 
through data collected via banking returns and other means 
on a regular basis. 


3.1.2 The arrangements whereby the auditors report on banking 
returns under §63(3) of the Banking Ordinance are intended 
to check, on a sample basis, the accuracy and reliability of 
the data submitted by Als in the returns. 


3.1.3 Under §63(3) of the Banking Ordinance an Al will normally 
be required by the MA to commission a report from its 
auditors each year on whether certain returns or information 
submitted to the MA have been correctly compiled in all 
material respects from its books and records. Normally the 
scope of the §63(3) report does not cover surveys (e.g. on 
credit card lending and residential mortgage lending). 


3.1.4 The returns to be reviewed will normally be: 


° for locally incorporated Als: 


- Capital adequacy-Ati pars}; 
- Large exposures (Columns—t+—5_of Partst-and 


Hselected parts)’; 
- Liquidity position (selected parts, depending 


on whether the Al is a “category 1 institution” 
or “category 2 institution”) S 


— Loans and advances (selected parts); 





1o Category 1 institution means an Al designated under rule 3(1) of the Banking (Liquidity) Rules (“BLR”) as a 
category 1 institution. Category 2 institution means an Al that is not a category 1 institution. 
14 
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3.2 


11 See footnote 10. 


- Mainland activities; and 
- Compliance (Pats+-Hselected parts). 
° for overseas incorporated Als: 


- Large exposures (Columns—+—5-of Parts and 
‘selected parts)"; 


- Liquidity position (selected parts, depending on 
whether the Al is a “category 1 institution” or 
“category 2 institution’) (Pat) 


- Loans and advances (selected parts); 
- Mainland activities: and 


- Compliance.” 


However, the MA reserves the right to require a report on 
other returns or information submitted under §§50(1)(a) & (b) 
and 63(1) & (2). 

The returns to be checked should be the most 
comprehensive in the series. Thus where an Al completes 
a consolidated return it should be that return which is 
checked. Where it has overseas branches but no 
subsidiaries the combined return should be checked, and so 
on. The returns only apply, in the case of overseas 
incorporated Als, to their Hong Kong offices. 











Reporting frequency and timing 


3.2.1 


3.2.2 


The returns are normally to be checked annually. The 
frequency may, however, be increased if there are particular 
grounds for concern. 


The returns to be checked should all relate to one date or 
period. Normally returns with a common reporting date will 
be chosen for review on a random basis, i.e. as at end- 
March, end-June, end-September or end-December. The 
date or period will not necessarily be coterminous with the 
end of an Al’s financial year. 


? The exact scope of review will be indicated in the HKMA’s notification letter to respective Als. 
15 
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3.3 


3.2.3 


3.2.4 


3.2.5 


The particular reporting date will be chosen retrospectively 
and notified in writing to the Al concerned shortly after the 
returns have been submitted. This notification letter will be 
copied to the auditors directly. Als should therefore retain 
the necessary information, including the working papers, for 
a sufficient time to ensure that this work can be done. 


Notwithstanding the foregoing, the MA reserves the right to 
add other reporting dates into the process if he is not 
satisfied with the quality of an Al’s data complied. 


The auditors’ report should be submitted by the Al to the MA, 
with any comment the Al wishes to make, not later than two 
months from the date of the MA’s notification letter. Prior 
consent from the HKMA may be sought for an extension 
of the deadline for submission, if there is good justification. 


Criteria for reporting errors 


3.3.1 


3.3.2 


The MA requires only errors which are material in amount or 
indicative of weaknesses in the compilation process to be 
drawn to his attention. The intention is for the auditors to 
focus on the quality of the statistics provided rather than on 
identifying minor reporting errors. What constitutes material 
will need to be judged by the auditors on a case-by-case 


basis. Forexample-an-error should normally be considered 


paateraltitexceeds-54of the-appicable-temtatie eae 
to-which-it relates. Auditors should focus on the impact of 
errors on the return that is subject to examination and 
relevant items in other returns that are within the scope of 
section 63(3) reporting. 


Auditors should evaluate whether an error is material in the 


context of quantitative factors as well as qualitative factors. 
A deviation of 5% or more in a particular line item in a return 
is a general quantitative reference. Nevertheless, an error 
that_affects compliance with the law_or regulation (e.g. 
failure to meet the minimum regulatory capital adequacy or 
liquidity requirements) is considered as material even if it is 
within 5% of the applicable item in the return. The 


materiality threshold should be adjusted downward when 
16 
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the actual prudential ratios of the Al are close to the 
requlatory limits or the Al’s internal triggers. 


3.3.3 Additionally, auditors should consider whether the errors 


identified are material individually or in aggregate as well as 
the qualitative aspects of the errors. In the case of multiple 
exceptions where each individual exception has an impact 
of less than 5% for a specific line item, materiality should be 
assessed by looking at the aggregate impact of the 
identified exceptions taking in consideration the nature of 
line items and the activities of the Al concerned. Material 


errors, regardless of their causal factors, should be reported 
to the HKMA. 


3-3.43.3.4 Auditors should prepare the report based on the findings 


identified in the latest returns erginalhysubmitted to the MA 
before the commencement of auditors’ work, unless the MA 
specifies otherwise. Any subsequent amendments to the 
returns to correct the reporting errors identified after the 
submission or during the course of the review should not be 


considered. Auditors should specify in their reports the 


submission dates of the returns that have been reviewed by 
them. 





3.3-23.3.5 Als and their auditors should bear in mind the penal 


provisions of §§50(6) and 63(7) of the Banking Ordinance 
relating to the knowing or reckless provision of false or 
misleading information. 


Auditors’ reporting on various internal control systems 


4.1 General 


4.1.1 


The Banking Ordinance splits the reporting requirement on 
internal controls into two broad categories: 


° Als are required to submit reports by auditors on 
certain internal control systems on a recurring annual 
basis; and 

° reports on other internal control systems are to be 
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commissioned on an ad hoc basis as needed. 
4.2 Annual reviews 


4.2.1 The MA is empowered under §63(3A)(a) of the Banking 
Ordinance to require an Al to submit an auditors’ report on 
whether, during a specified period, the internal control 
systems of the Al were such as to enable, as far as 
practicable: 


° the correct compilation of returns or information from 
the books and records of the Al (see Annex AB); 


° compliance by the Al with the provisions under Parts 
XII, XV, XVUEXVIAT and XVULXVIB of the Ordinance 
(see Annex BC); and 





° in the case of locally incorporated Als, adequate 
provision for depreciation or diminution in the value of 
assets (including provision for bad and doubtful debts) 
and for actual or potential liabilities and losses (see 
Annex GD). 


4.2.2 Having completed this work, the auditors should also report 
under §63(3A)(b) of the Banking Ordinance in respect of the 
same period on: 


° any material contravention of the provisions under 
Parts XII, XV, XVIA}** and XVHI-XVIB_of the 
Ordinance by the Al; and 


° in the case of locally incorporated Als, any failure to 
maintain adequate provisions. 


4.2.3 Only one report is to be submitted under §63(3A) and it will 
normally be required annually. 


4.2.34.2.4 The report submitted under §63(3A) should cover all the 
matters set out in paras. 4.2.1 and 4.2.2 above. Pursuant to 


1 


3 Part XVIA of the Banking Ordinance does not apply to overseas incorporated Als. 


See footnote 13. 
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§63(3D), a report will not be required on a matter referred to 
in §63(3A)(b) unless the requirement also relates to a 
matter referred to in §63(3A)(a). Thus a report under 
§63(3A)(b) will not be commissioned in isolation. 


| 4.2.5 In reporting under §63(3A)(b), the auditors will draw 
particularly on their work performed under §63(3A)(a) but 
they will also be expected to take into account any other 
relevant information®’ which comes to their attention in their 
capacity as auditors of the Al, including in the normal course 
of their audit work and in their review of returns under 
§63(3). They will not, however, be expected to change the 
scope of their audit work nor the frequency or timing of their 
audit visits. In cases where the audit work has not been 
completed, the auditors can refer to that fact in their report. 


| 4.2.44.2.6 For overseas incorporated Als which are exempt from 
local statutory audits, the auditors are expected to set the 
scope and extent of tests to facilitate their reporting in 
accordance with the requirements of §63(3A)(a) and (b). 





| 4.2.7 __The period to be covered by a report under §63(3A) will not 
normally be more than 12 months unless the MA is satisfied 
that a longer period is required in the interest of the 
depositors or the public. Usually it will be the financial year 
of the Al so as to coincide with the work on the annual audit. 
In the case of an overseas incorporated Al, a different 
period for review may be agreed if that is mutually 
convenient to the Al, its auditors and the MA. Once 
determined for the initial report, the review period will 
normally be the same for subsequent reports. 


4.2.54.2.8 The scope and period to be covered by the report 
required under §63(3A) will normally be notified in writing to 
Als three months before the end of the period to be 
reviewed. The notification letter will be copied to the 
auditors directly. The Al should in turn issue a letter of 





15 It is recognised that such information may already have given rise during the period under review to a report 
| under §§61, 63A andor 63B. In such cases the auditors will not be required to report again on the matter under 
§63(3A)(b) unless there had been further developments which materially affected the position. 
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4.3 


instructiont® to its auditors with a copy to the MA. 


4.2.64.2.9 The report should be submitted to the Al by the auditors 


not later than three months from the end of the review 
period and should be forwarded to the MA with the 
comments of the Al, if any, within a further month. 


4274.2.10 In making a report on internal controls under 


§63(3A)(a), the auditors will be asked to report on both the 
existence of controls and whether they have operated 
effectively during the review period. In drawing attention to 
any weaknesses or failures in the control system, they will 
be asked to report only those which, in their judgement, are 
material. Where weaknesses or failures in controls have 
been identified, the auditors should, if possible, make 
recommendations for improvement. It is not, however, the 
responsibility of the auditors to ensure that such 
recommendations are implemented by the Al. 


4.2.84.2.11 A materiality test should also be applied in 


reporting any matters under §63(3A)(b). What constitutes 
material or adequate will need to be judged by the auditors 
on a case- by-case basis. In the case of an overseas 
incorporated Al, —it is adverse matters which are material in 
the context of the _—Al’s operations in Hong Kong which 
should be reported. 


Ad hoc reviews 


4.3.1 


4.3.2 


The MA also has a discretionary power under §59(2) of the 
Banking Ordinance to require an Al, after consultation with 
the Al, to provide an auditors’ report on such matters as he 
may specify for the performance of his functions under the 
Ordinance. This power will, among other things, enable the 
MA to require an Al to appoint auditors to conduct a review 
on its internal control systems in specific areas of operations. 


Major areas of control which may be covered in sueh-aad- 
hoc reviews include but are not limited to: 


| 16 The letter of instruction can remain effective from-after enean accounting period te-anetheruntil it is replaced. 
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e corporate governance (CG-1 “Corporate Governance 
of Locally Incorporated Authorized Institutions”); 





° risk —management— system -(IC-1 —“General 
Risk Management GertrolsFramework”); 


° controls relating to specific operational areas 
(e.g. lending or trading activities); 


° loan _—classification _—system 
a 17 
° information technology (TM-G-1 -“General Principles 


for Technology Risk Management”); 


“Business Continuity Planning”); 


° prevention of money laundering (AML-4-2 “Guideline 
on Anti-Money Laundering and Counter- Financing of 
Terrorism (For Authorized Institutions)Prevention—of 

Money Laundering’); and 
° internal audit function (IC-2 “Internal Audit-Legatand 
Compliance Function””). 

In determining the audit procedures of a review, the auditors 

may refer to the abeve—relevant_Supervisory Policy—m 


Manual module(s)_as well as circulars and guidelines to Als 
for guidance. 


° business —continuity —planning ——————(TM-G-2 


4.3.3 This type of report will be commissioned where an 
| independent review -is required in particular areas. The 
circumstances which may lead to a decision to commission 

a report include: 


| ° a management letter!" from the Al’s auditors which 
revealed significant weaknesses in internal controls; 








in Appendices 2 and 2.1 of the completion instructions for the banking return MA(BS)2A (Quarterly Analysis of 
Loans and Advances and Provisions) as well as other relevant circulars issued to Als. 


Als are required to provide a copy of the auditors’ management letter to the HKMA for review (see subsection 
11.1.2 of CG-1 “Corporate Governance of Locally Incorporated Authorized Institutions”). 
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4.3.4 


4.3.5 


4.3.6 


° particular issues arising from the HKMA’s on-site and 
off-site examinations, prudential interviews, tripartite 
meetings, internal auditors’ reports, external auditors’ 
reports on annual aeceunts-financial statements and 
ad hoc reports made by the auditors under §61 of the 
Banking Ordinance; 


° frequent errors detected in returns submitted to the 
MA or other indications of irregularities in the returns; 


° material adverse events or transactions which affect 
the business operations or financial position of the Al. 
These will include matters reported by the auditors 
under §§63(3), 63(3A), 63A or 63B; and 


° significant exposure to business activities or new 
product lines which require strong systems support 
as part of the risk management process. An example 
is dealing in derivative instruments with a high 
degree of price volatility. 


The MA may also use his powers under §59(2) to 
commission reports on other matters which are relevant to 
the exercise of his functions under the_Banking Ordinance, 
e.g. in relation to review of particular transactions. A report 
may also be commissioned on the financial affairs of the Al, 
based on an audit of its acceuntsfinancial statements. Such 
a report will only be commissioned where the MA has 
reason to believe that the normal audit by the Al’s auditors 
was, or was likely to be, seriously deficient. 


The period to be covered by a report under §59(2) will vary 
depending on the circumstances but it will not normally 
exceed 12 months. A report will be commissioned after 
prior consultation with the Al and its scope (i.e. terms of 
reference) will be agreed in advance with the Al and its 
auditors. 


The scope of the review, the period to be covered and the 
due date for submission will be notified in writing to the Al. 
The Al should in turn issue a letter of instruction to its 
auditors with a copy to the MA. 
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4.3.7 The auditors’ report should normally be submitted to the Al 
not later than three months from the end of the review 
period and forwarded with the comments of the Al, if any, to 
the MA within a further month. The MA reserves the right to 
require a shorter deadline in special circumstances, after 
consultation with the Al and the auditors concerned. 


4.3.8 The auditors’ report should also be communicated to those 
charged with governance of the Al. For an Al incorporated 
outside Hong Kong, it should inform its head office of the 
reviews conducted at the branch and provide the head 
office with the auditors’ report. 


4.3.74.3.9 Apart from the reviews commissioned under §59(2) of 
the Banking Ordinance, the HKMA may also require the Al 
to_appoint an auditor to examine and report upon specific 
subject matters or transactions undertaken by the Al that 
would be appropriate for the purpose of the HKMA’s 
supervisory functions under the Ordinance. Guidance 
provided in this module is applicable to these reviews, 


unless otherwise determined by the HKMA and notified to 
the Al. 


5. Auditors’ reporting on certain specified matters 


5.1 Reporting of significant adverse matters 


5.1.1 Under §63A of the Banking Ordinance, the auditors of an Al 
are required to submit a report in writing, as soon as is 
reasonably practicable, to the MA if they, in the course of 
performing their duties as auditors, become aware of a 
matter which, in their opinion, adversely affects the Al’s 
financial position to a material extent. The report should 
cover the nature of the matter and the reason(s) why they 
are of that opinion. 


5.1.2 In determining whether a matter should be reported to the 
MA under §63A, an Al’s auditors should consider, among 
other things, the following issues: 


23 








(Aip\ Honc Konc Monetary AUTHORITY 
PV FRECHE 





Supervisory Policy Manual 




















IC-3 Reporting Requirements Relating to V.t2- 
Authorized Institutions’ External Nees 
Auditors under the Banking Ordinance 
° whether the Al’s status as a going concern is 


5.1.3 


questionable (e.g. a material loss that may threaten 
the financial condition of the Al); 


e whether the Al’s capital adequacy ratio has dropped, 
or will drop, significantly to a level which may be 
detrimental to depositors; or 


e whether the liquidity position of the Al has 
deteriorated or will deteriorate to a level which is 
likely to threaten the interests of depositors. 


For locally incorporated Als, the auditors should look at the 
matter in the context of the Al as a whole. If the Al 
concerned is incorporated outside Hong Kong, the auditors 
should consider any such matter in the context of its 
principal place of business in Hong Kong and its local 
branches as if that principal place of business and those 
branches were collectively a separate Al. 


It is also an Al’s responsibility to report to the MA if it 
becomes aware of such matters affecting its financial 
position. The Al should bring such matters to the attention 
of the MA as soon as it has reason to believe that they 
could have a material adverse effect on the Al or on the 
interests of depositors. Specifically, an Al is required to 
notify the MA under §67 of the Banking Ordinance if it is, or 
is about to become, unable to meet its obligations, and 
under §§99-97D and 971493 of the Ordinance, where it fails 
to keep its capital adequacy or liquidity ratios at or above 
the prescribed levels. 


5.2 Reporting of non-compliance with the SFO 


5.2.1 


Under §63B of the Banking Ordinance, the auditors of an Al 
are required to submit a report in writing, as soon as is 
reasonably practicable, to the MA if they, in the course of 
performing their duties as auditors, become aware of any 
matter that, in their opinion, constitutes on the part of a 
registered Al a failure to comply with any prescribed 
requirements within the meaning of §157 of the SFO. 
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5.2.2 Under §157 of the SFO, “prescribed requirements” refer to 
the requirements of any rules made under §§148, 149, 151, 
152 or 397 of the SFO. These requirements generally relate 
to the management of client securities and collateral, 
holding of client monies, keeping of accounts and records, 
provision of contract notes, receipts, statement of account 
and notifications, etc.- 


5.2.3 Given the nature of Als’ deposit taking business, the 
requirements relating to the holding of clients’ monies under 
§149 of the SFO are specifically excluded for purposes of 
§63B of the Banking Ordinance. 


5.2.4 Auditors of registered Als should therefore familiarise 
themselves with the relevant regulations and requirements 
issued by the SFC in order to fulfil their duties under §63B 
of the Banking Ordinance. Nevertheless §63B does not of 
itself require auditors to change the scope, nature and depth 
of their audit work"2"*. They are not required actively to seek 
out grounds for making a report under this section. It is only 
when they become aware, in the ordinary course of their 
work, of a matter of the kind described in para. 5.2.2 above 
that they should make a report to the MA. 


6. Communication between the auditors and the HKMA 


6.1 Protection 


6.1.1 §61 of the Banking Ordinance permits auditors, 
notwithstanding any duty which they may owe to their 
clients (e.g. confidentiality), to communicate with the MA, 
provided that: 


® the communication, whether or not in response to a 
request by the MA, is in good faith; and 


19 It is acknowledged that the scope and extent of audit work on the securities dealing operations of an Al may 
vary from institution to institution, depending on the size of the its operation. 
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6.2 


6.1.2 


e the information so disclosed relates to information or 
opinion on a matter of which they become aware in 
the capacity of auditors and which is relevant to any 
function of the MA under the Ordinance. 


a 


The protection covers not only auditors appointed under 
§395, 396, 397 or 398434 of the Companies Ordinance but 
also auditors appointed for the purpose of §§50(1)(c), 59(2), 
63(3) and 63(3A) of the Banking Ordinance. It also covers 
auditors who make a report to the MA as required under 
§§63A and 63B of the Banking Ordinance. 


The protection afforded by §61 of the Banking Ordinance is 
general and not restricted by the circumstances in which the 
information is obtained or by its sources. Provided the 
information becomes known to the auditors in the capacity 
as the auditors of an Al, they may communicate that 
information to the MA notwithstanding that: 





° the information does not relate to the auditing work 
undertaken by them; or 


° the source of the information was not the Al. 


§61 of the Banking Ordinance does not of itself require 
auditors to change the scope, nature and depth of their 
audit work. They are not required to actively seek out 
grounds for making a report under this section. It is only 
when they become aware, in the ordinary course of their 
work, of any situation as described in para. 6.2.3 below that 
they should make detailed enquiries with §61 in mind. 


Direct reporting to the HKMA 


6.2.1 


For matters required to be reported under §§63A and 63B of 
the Banking Ordinance, it is the auditors’ obligation to report 
them directly (i.e. not via the Al) to the MA. The auditors 
should also consider providing a copy of the report to the Al 
concerned at the same time. 
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6.2.2 


6.2.3 


6.2.4 


Apart from matters required to be reported directly by the 
auditors under §§63A and 63B of the Banking Ordinance, 
the MA recognises that it is important for auditors to act in a 
manner that will preserve their professional relationship with 
their client Als. It is therefore expected that the auditors will 
normally discuss with their Al any matter about which they 
are concerned, and request the Al to draw the matter to the 
attention of the MA (or obtain evidence that shows that the 
matter has been reported to the MA). 


Where an Al declines to report to the MA or the matter has 
not been brought to the attention of the MA within a 
reasonable period of time, the auditors should consider 
making a report directly to the MA in respect of any matter 
(other than those already required to be reported under 
§§63A and 63B of the Banking Ordinance) where they 
consider that depositors’ interests might be better protected 
if the MA was made aware of it. Examples of such matters 
include: 


° when there appears to the auditors to be a material 
contravention of one or more of the requirements of 
the Banking Ordinance; 


e where the auditors have evidence of an occurrence 
which has led or is likely to lead to a material 
diminution of the Al’s assets; 


° when the auditors form the opinion that there has 
been a significant failure of, or that there is a 
significant weakness in, the Al’s accounting and other 
records or internal control systems; or 


° when the auditors form the opinion that management 
has reported financial information to the MA which is 
materially misleading or become aware that 
management has failed or does not intend to report 
something and the failure to report is, or would be, 
materially misleading. 


In exceptional circumstances, where it is in the interest of 
protecting depositors that the management of the Al should 
27 
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6.2.5 


not be informed in advance, the auditors should report 
directly to the HKMA having first considered independent 
legal advice, as is deemed necessary. Examples of these 
circumstances are: 


where there has been an occurrence which causes 
the auditors no longer to have confidence in the 
integrity of the directors or senior management, e.g.: 


- where they believe that a fraud or other 
misappropriation has been committed by the 
directors or senior management of the Al; or 


- where they have evidence of the intention of 
directors or senior management to commit a 
fraud or misappropriation; 


where there has been an occurrence which causes 
the auditors no longer to have confidence in the 
competence of the directors or senior management 
to conduct the business of the Al in a prudent 
manner so as to protect the interests of depositors, 
e.g.: 
= where they have discovered that the directors 
or senior management are acting in an 
irresponsible or reckless manner with respect 
to the Al’s affairs; or 


7 where they have evidence of an intention so to 
act; and 


where the Al refuses or fails to inform the HKMA of a 
matter within the specified time period, having been 
advised to do so by its auditors, or where there is 
evidence that the Al has not adequately and properly 
reported the matter in question. 


In these exceptional circumstances the auditors may wish to 
consider whether the matter should be reported at an 
appropriate senior level in the Al (e.g. audit committee) and 
whether an appropriate representative of the Al (e.g. an 
independent director) should be invited to attend a meeting 
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6.2.6 


with the HKMA. Decisions should be made in the light of 
the circumstances of each case. 


Speed of reporting may be important for the protection of 
depositors. Therefore, while the auditors may wish to take 
legal advice, they should also consider the possible impact 
on depositors’ interest arising from a delay in reporting the 
matter to the HKMA. 


6.3 Sharing of information with auditors 


6.3.1 


6.3.2 


6.3.3 


The MA is permitted under §120(5)(g) of the Banking 
Ordinance to disclose confidential information to an auditor 
of an Al or former Al or to a former auditor for the purpose 
of enabling or assisting the MA to discharge his functions 
under the Ordinance. 


With this authority, the MA will take the initiative, normally 
by calling a tripartite meeting, in bringing a matter to the 
attention of an Al and its auditors when: 


° he considers the matter of such importance that the 
auditors’ knowledge of it could significantly affect the 
form of their audit or other report or the way in which 
they carry out their reporting responsibilities; and 


° the disclosure is for the purpose of enabling or 
assisting the MA to discharge his functions under the 
Banking Ordinance or will otherwise be in the 
interests of depositors. 


Information so disclosed to the auditors remains confidential 
and should not therefore be further disclosed unless the MA 
consents. 


6.4 Tripartite meeting 


6.4.1 


Meetings involving the HKMA, an Al and its auditors may be 
called by any of these parties and convened at any time. 
Such meetings can be held on an ad hoc basis but for 
locally incorporated banks, they are normally convened on a 
yearly basis following the annual audit. 
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6.4.2 Matters discussed in the tripartite meeting typically include 
the results of the annual audit, presentation and content of 
the annual acceuntsfinancial statements and the work 
performed under §§50, 59(2), 63(3) and 63(3A) (Such as 
identified weaknesses in internal controls, adequacy of 
provisions and compliance with legal and other prudential 
requirements). 


6.4.3 Depending on individual circumstances, there would be a 
tripartite discussion to confirm expectations as to the scope, 
nature and _extent_of work to be performed prior to 
commencement of a §59(2) engagement. If changes need 
to be made to the scope, nature and/or extent of work 
subsequent to the commencement of engagement, such 
changes should be communicated and agreed by the 
auditors with the Al and the HKMA on a timely basis. In 
addition, for any material issues identified by the auditors 


during the course of their work, there should be timely 
communication with the Al and the HKMA. 


64.36.4.4 The HKMA will usually prepare an agenda for the 
tripartite meeting and include items at the request of the Al 
or its auditors. The auditors should forward any such 
request via the Al. An item may be included on the agenda 
even if the Al has not agreed. It may therefore be necessary 
for there to be direct communication between the auditors 
and the HKMA. 


64.46.4.5 Auditors should be aware of the MA’s functions under 
the Banking Ordinance and his responsibilities for the 
protection of depositors. They will be expected to participate 
fully in tripartite meetings. This will involve discussing 
matters relating to their client’s affairs, including information 
about the customers of their clients, arising from the 
statutory audit and from work required under the Ordinance. 


64.56.4.6 The HKMA recognises that it would not be appropriate 
for auditors to report to it any information about the Al 
obtained through their professional relationship with another 
client which is not the Al in question. 
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7. Industry guidance 


7.1 Als should read the Practice Note issued by the HKSA-HKICPA in 
relation to the auditors’ reporting responsibilities under the Banking 
Ordinance in conjunction with this module. 
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Annex A: Supervisory expectations relevant to the external audits 
and the auditors 


The supervisory expectations set out in this Annex with respect to the external audits and 
the auditors are based on the Guidelines “External audits of banks” published by the 
Basel Committee on Banking Supervision in March 2014. These expectations would 
assist Als’ audit committees in carrying out their responsibilities for monitoring and 
assessing external audits. 


1. The auditors of an Al should have banking industry knowledge and competence 
sufficient to respond appropriately to the risks of material misstatement in the 
Aľs financial statements and to properly meet any additional regulatory 
requirements. 


2. The HKMA expects that the audit engagement team, as a whole, has: 


@ proficient knowledge and understanding of, and practical experience with, 
the banking sector, associated banking industry and bank-specific risks, 
and the operations and activities of banks and bank audits. The audit 
engagement team may acquire this knowledge through specific training, 
participation in bank audits or work in the banking sector; 


® proficient _ knowledge and understanding of applicable accounting, 
assurance and ethical standards, industry practice and relevant guidance; 


° proficient knowledge of relevant regulatory requirements, and a general 


understanding of the legal and regulatory framework applicable to banks; 
and 


° proficient knowledge and understanding of IT relevant to bank audits. 


G: In some instances, expertise in a field other than accounting or auditing may be 
required to support the audit engagement team. Examples of such areas are 
certain complex valuations that may affect accounting estimates (e.g. valuation 
of complex financial instruments, commercial property valuations), regulator 
matters and the evaluation of complex IT environments, particularly in areas 
subject to_significant_risks of material misstatement. Audit engagement teams 
should use expertise as appropriate. 


4. In addition to being knowledgeable and competent in bank audits, the auditors of 
an Al should be objective and independent in both fact and appearance with 
respect to the bank. 
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5. When _ assessing whether any relationship or circumstance poses a threat to 
auditors’ independence, the auditors evaluate not just the specific rules on 
independence, but also the substance of the threat to independence, and how a 
reasonably informed third party would perceive the threat_and its effect_on the 
auditors’ objectivity. The provision of non-assurance services by the audit firm 
and, when applicable, network audit firms to the Al being audited may 
particularly affect_a third party’s perception of the auditors’ independence. Such 
situations should be evaluated for threats to the auditors’ objectivity and 
perceived independence. 


6. The auditors of an Al should exercise professional scepticism when planning 


and performing the audit, having due regard to the specific challenges in auditing 
the Al. 


T. It_is of particular importance that professional scepticism is exercised by the 
auditors in the following areas: impairment calculations, fair value measurements 
and _ going concern assessments, including assessments of solvency and 
liquidity. Other examples are complex transactions lacking substance or a sound 
business purpose that_management_has_ structured to achieve a_particular 
accounting treatment and/or regulatory outcome where audit engagement 
partner has or ought to have reasonable doubt that the proposed accounting 
treatment_and/or requlatory outcome is consistent with the relevant financial 
reporting framework or regulatory requirements. In this context, auditors are 
expected to challenge management's inputs and assumptions and _ form 
independent views. This includes challenging evidence obtained from 
management that corroborates management's view. 


8. The evidence of the extent of professional scepticism exercised should be 
demonstrable and understandable through audit documentation that describes 
what conclusions were reached by the auditors and how. 


9. Audit firms should also comply with the applicable standards on quality control. 
Systems of control should be in place to emphasise quality and consultation and 
to create a culture of compliance with auditing and ethical standards as well as 
applicable legal and requlatory requirements. 


10. Certain financial statement items are used in the calculation of key metrics used 
by a wide range of users of the financial statements. For example, regulatory 
ratios such as the leverage ratio, liquidity ratio and capital adequacy ratio are 
calculated based on account balances reported in the financial statements or are 
derived from the financial statements. The auditors of an Al are expected to 


consider these ratios as an input to the determination of materiality thresholds 
for the audit. 
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Annex AB: Controls relating to the compilation of banking returns 


Objective 


Als should have adequate systems and controls to permit the submission of 
reliable statistics and information to the HKMA. The statistics and information 
submitted should be complete, accurate and prepared in accordance with the 
HKMA’s completion instructions. 


Key controls and procedures 


Auditors should develop audit procedures to assess whether the Al has controls 
in place to satisfy the above objective, taking into account the nature, size and 
complexity of an Al’s business. In developing the audit procedures, they may 
have regard to the following: 


e Roles and responsibilities with regard to compilation and review _of 
banking returns and other information are clearly defined; 


° A procedures manual is established, setting out the timing of reports, their 
compilation method, information sources used and other information 
gathering techniques which are necessary to ensure the complete, timely 
and accurate compilation of returns and other information; 


° Clear, concise and organised working papers for the compilation of 
returns and other information are maintained to provide traceable links 
between the accounting records and completed returns. Any material 
discrepancies between the records and the returns are investigated and 
explained; 


° The approach and procedures used in the compilation of returns and 
other information are clearly understood by the officers responsible for the 
preparation and checking. The various guidelines and instructions issued 
by the HKMA relating to the completion of returns are properly filed and 
kept up-to-date to facilitate future reference; 


«The approach and procedures used in the compilation of returns and 
other information are timely updated for changes in regulatory reporting 
requirements and changes in business or operations. The updated 
procedures and reporting treatments are reviewed by an appropriate level 
of the Al’s management; 


° Where the calculations involve the use of internal models, governance 
and_controls_are_in place to ensure consistent application of the 
established methodologies and assumptions as well as proper 
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management of subsequent changes. 


e Where computer-based tools or systems are used for compiling returns 
and other information (whether maintained by the Al itself, its head office 
or third party vendor(s)), relevant procedures are put in place to ensure 
the reliability of outputs generated from such computer-based tools or 
systems; 


e Reconciliations are prepared to summarise adjustments made between 
the originally submitted returns and subsequent returns. Root causes of 
the adjustments are identified and relevant controls and procedures are 
enhanced to rectify the issues; 


e Any questions or clarification regarding the compilation process are 
referred to the HKMA. A note of any discussions is made for future 
reference; 

e Prior to submission, returns and other information are checked by a 


designated officer who takes no part in the actual preparation work; and 


Q Procedures are adopted to ensure that staffing changes do not affect the 
quality of returns and other information; and 


e For_a locally incorporated Al, the above controls should also take into 
account the data and information from the Al’s overseas branches and/or 


its non-bank subsidiaries that are within the scope of regulatory 
consolidation. 
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Annex BC: Controls relating to compliance with statutory provisions 
in the Banking Ordinance 


1. Objective 


Als should have effective monitoring and reporting systems to enable compliance 
with their statutory duties under the Banking Ordinance at all times. 


2. Key controls and procedures 


Auditors should develop audit procedures to assess whether the Al has controls 
in place to satisfy the above objective, taking into account the nature, size and 
complexity of an Al’s business. In developing the audit procedures, they may 
have regard to the following: 


General controls 


° Management are fully aware of the relevant statutory provisions and 
regulatory requirements in relation to the Al’s operations; 


° There is central filing of the Banking Ordinance, guidelines and circular 
letters issued by the HKMA (whether by mail or through electronic 
delivery), relevant communications with the HKMA and amendments to all 
these documents. There are also established procedures to ensure that 
such information are communicated effectively within the Al to those who 
need to be aware of it; 


° A procedures manual is established_and maintained to ensure compliance 
with statutory and regulatory requirements in all aspects of the Al’s 
operations; 

° Procedures are in place to ensure compliance with statutory and 


regulatory requirements. They deal not only with day-to-day operations 
befereintreductionbut also the process of introducing-ef new products 


and engagement engaging in new business activities; 
° An officer (e.g. compliance officer) has been designated with the 


responsibility to monitor and ensure compliance with statutory and 
regulatory requirements; 


e Adequate management reports on compliance with statutory and 
regulatory requirements are produced and reviewed by relevant 
management members and the compliance officer in a timely manner; 
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Procedures are in place to ensure that any failure to comply with statutory 
or regulatory requirements is reported to the HKMA_as well as to the Al’s 


senior management_and those charged with governance as soon as 
practicable; and 


Clear, concise and organised werking—papersdocumentation for 


monitoring compliance are maintained to provide audit trails for 
subsequent verification. 


For_a locally incorporated Al, the above controls should also take into 
account the Al’s overseas branches and/or its non-bank subsidiaries that 


are within the scope of regulatory consolidation. 


Compliance with Part XV_of the Banking Ordinance — Limitations on 
exposures and interests of Als 


There is a written policy on concentration of exposures particularly large 
exposures and exposuresadvances to connected parties which sets out, 
among other things, the Al’s strategy to prevent undue concentration of 
risks and, specifically, the systems and procedures to ensure compliance 
with statutory and regulatory requirements; 


Limits are established for_individual counterparties custemers—er group of 


linked counterparties, connected _partiesrelated—customers, equity 


exposures and interests in land to prevent any potential breach of the 
Banking (Exposure Limits) Rules (“BELR”) made under Part XV_of the 


Banking Ordinance. Where appropriate, sub-limits should be allocated to, 
and observed by, business units, branches or subsidiaries. The limits and 
sub-limits should be set at levels lower than the statutory limits under 


§§8+ and 83 cHhe Ordinanecethe BELR so as to ensure compliance on a 


continuous basis; 


Systems and processes are in place to support (1) the accurate valuation 
of individual exposures by taking into account the effect of applicable 
credit risk mitigation and (2) the accurate calculation of aggregate 


exposures; 
The internal reporting and monitoring system is able to provide timely 
information for management’s attention or action and enable any 
breaches or exceptions to be identified and reported to the senior 
management immediately; 

A central liability record to ensure compliance with §§8+-and-83-cithe 
BELR Ordinance— is maintained to capture all financial-exposures to 
relevant customers, including those extended through branches or 
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subsidiaries, and that record is kept up-to-date at all times; 


e Procedures are in place for effective control of exposures including 
facilities approved at a branch or subsidiary level and to ensure that such 
facilities-exposures are captured in the central liability record in a timely 
manner; and 


e Financial-eExposures which are exempt from §§8+~—and—83—of the 
Ordinancethe BELR are adequately monitored to ensure that the terms 
and conditions for exemptions are complied with at all times. 





(See also CR-G-8 “Large Exposures and Risk Concentrations” and CR-G-9 
“Connected LendingExposures to Connected Parties” for detailed guidance.) 


Compliance with Part XVIA of the Banking Ordinance — Capital 
Adequacyrequirements 


e A written policy is established to set out the Al’s strategy on capital 
adequacy and leverage ratio requirement and how it intends to maintain 
adequate capital to support its various business activities and to meet 
statutory and regulatory requirements; 


e Target capital adequacy rates—and leverage ratios are set at a level 


above the #iggerminimum raties-regulatory requirements and any higher 
limits imposed by the HKMA to ensure continuous compliance; 


° Capital —adequacy—bBudgets (on solo and consolidated basis where 
appropriate) are prepared at least_annually_for capital adequacy and 
leverage ratio requirements, taking into account the projected asset mix, 
expected balance sheet growth and capital resources. Where appropriate, 
limits on balance sheet growth are imposed on business units, branches 
and subsidiaries; 


e Systems and procedures are in place to enable the management to 
monitor its capital adequacy and leverage ratios (on solo and 
consolidated basis where appropriate) on a continuous basis; and that 
any adverse variance against the target ratio(s) and, particularly, any 
breach-offailure to meet the trigger or minimum ratios, should be reported 
to the chiefexecutivesenior management immediately; 


° The impact of large loans, major investments and other significant 


transactions on capital adequacy and leverage ratio requirements is 
assessed in advance; and 


e Stress-testing on capital adequacy ratio is performed on a regular basis 
(see IC-5 “Stress-testing” for further details). 
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Compliance with Part XVIB of the Banking Ordinance — Liquidit 
requirements 
° A written policy on liquidity is established to set out the Al’s strategy and 


procedures for maintaining adequate liquidity at all times and, specifically, 
to meet statutory and regulatory requirements; 


e Category 1 institutions should have systems and procedures in place to 
ensure: 


-_assets included as high quality liquid assets (“HQLAs”) for the purpose 
of calculating the Liquidity Coverage Ratio (“LCR”) and the Net Stable 
Funding Ratio (“NSFR”) continuously satisfy all requirements relatin 
to asset class, characteristics and operational requirements as 
specified in the BLR; 


- the institution’s HQLAs and related risks (including foreign exchange 
risk and concentration risk) are managed on an ongoing basis; 


- methodologies (including key management assumptions) are properl 
established, reviewed and applied to determine the amounts of certain 
expected cash flow items (such as “operational deposits”, potential 
drawdown on undrawn committed facilities and non-contractual 


contingent funding obligations) for the calculation of the LCR and the 


NSER; 
e Category 2 institutions should have systems and procedures in place to 
ensure: 


- assessment and management of liquefiable assets and related risks 
are conducted on an ongoing basis, and each asset included in the 
liquefiable assets satisfies all the applicable requirements as specified 


in the BLR; 


-— assessment and management of Core Funding Ratio ("CFR") and 
related risks are conducted on an ongoing basis (applicable to 


"category 2A institutions"): 


e Systems, controls and procedures are in place to ensure that_the 
valuation of any asset, liability, off-balance sheet item or cash flow 
measured at fair value is prudent and reliable for the purposes of 
calculating the LCR, Liquidity Maintenance Ratio ("LMR"), NSFR or CFR; 


e Target liquidity and maturity mismateh_ratios (LCR, LMR, NSFR and/or 
CFR) are set at a level above the statutery-minimum regulatory rate 
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requirements_and any higher limits imposed by the HKMA to ensure 
continuous compliance; 


e Systems and procedures are in place to enable the-managementio 
mreniterthe—actual liquidity and-maturtymismateh_ratios to be reported 
and monitored on a continuous basis and, specifically, any breach-efthe 
targetratioses or exceptions to be identified and 4sreported to the senior 
managementchief executive immediately; 








e The impact of large loans, major investments and other significant 
transactions on liquidity is assessed in advance; and 

e Contingency plans are in place for coping with various types of liquidity 
crisis; and 

e Stress-testing on the liquidity position is performed on a regular basis. 

(See LM-+-2 “Liquidity Risk ManagementSound Systems and Controls for 

Liquidity Risk Management” for detailed guidance.) 
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| Annex GD: Controls relating to the maintenance of adequate 
provisions 


1. Objective 


| Als should have adequate pelicies—and—proceduressystems of control for 
assessing the quality of their assets regularly and for establishing adequate 


provisions for depreciation or diminution in the value of their assets (including 
provision for bad and doubtful debts). 





2. Key controls and procedures 


Auditors should develop audit procedures to assess whether the Al has controls 
in place to satisfy the above objective, taking into account the nature, size and 

| complexity of an Al’s business. In developing the audit procedures, they may 
have regard to the following: 


° Policies and procedures are established to set out the frequency, 
| methodology and level of generaland—specific—provisions (including 
country risk provisions as appropriate) to be maintained for each type of 

assets and off-balance sheet exposures, and contingent liabilities; 





° A multiple-grade loan classification system is established to monitor asset 
quality on a regular basis. The sophistication of the system should be in 
line with the nature, size and complexity of the Al’s business. It should 
have a clear definition for each loan grade and respective classification 
criteria that consist of both qualitative and quantitative factors; 


e Adequate provisions should be maintained. In general, these will be 
determined on a loan-by-loan basis, with full provision made for the likely 
loss. In the case of loans managed on a portfolio basis (e.g. credit cards) 
or where the Al is unable to determine the likely loss reliably on a loan-by- 
loan basis, minimum levels of provision may be set for each loan grade 
under the loan classification system="*; 

° Procedures are established for reviewing and setting aside generaland 
specific_provisions on a regular basis; 


20 Auditors can generally rely on the testing of controls performed during the audits of the financial statements of 


Als. In case the auditors’ tests conducted during the financial statements audits are mostly substantive in nature, 
they should conduct additional testing procedures that enable them to provide reasonable assurance on the Als’ 
internal control systems relating to the maintenance of adequate provisions. 
For further details, see “Guideline on loan classification system” as set out in Appendix 2 of the completion 
instructions for the banking return MA(BS)2A (Quarterly Analysis of Loans and Advances and Provisions). 
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Specific officers or committees are charged with the responsibility for 


approving and reviewing gereratand specific-_provisions; 


Procedures are in place to ensure that the provisioning decisions and the 
basis for these decisions are recorded and reported to senior 
management or a relevant committee (e.g. credit committee) on a regular 
basis. Where appropriate, such information should also be reported to 
the Board;-and 


Procedures are in place for: 


- the monitoring of asset quality and loan concentration by country 
and sector; 


- the monitoring of adverse economic or political factors which might 
affect the quality of the loan portfolio or particular types of 
borrowers; 


- the monitoring of overdue and rescheduled assets; 
- the review of irregularities in individual credit exposures; 
- the review of borrowers’ and guarantors’ financial positions; 


- the review of and updating of value of collateral on a regular basis; 
and 


- the suspension or cessation of interest accrual for classified assets; 
and 


With the implementation of expected credit loss (“ECL”) required under 


HKFRS 9 “Financial Instruments” auditors are expected to consider the 
following elements in developing the audit procedures over ECL on top of 
the controls and procedures discussed above: 


- For each class of on- and off-balance sheet exposures, policies 
and procedures detailing the ECL methodologies, the key 
assumptions and the rationale for the choices made, the roles and 
responsibilities of the personnel involved, as well as the frequency 
and approach for the review and recalibration of models; 


- Review and challenge by the Al’s management and those charged 
with governance take place on a reqular basis with respect to the 
appropriateness of forward-looking information used in the ECL 
estimation (e.g. the choice of forward-looking scenarios, the 
probabilities assigned to these scenarios, key assumptions and 
judgement applied) as well as the adequacy of ECL allowances: 


- Periodic validations of ECL models are conducted by independent 
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parties (internal or external), with the findings of model validation 


and the remedial actions (if any) reported to the appropriate level 


of management and board committee(s) in a timely manner; 


- Controls are put in place to ensure the completeness and 
accuracy of data used in the ECL estimation, including the quality 
of externally sourced data or information; 


- There are general IT controls and other application controls 
(automated or manual) over the data transfers between systems 
and_ the ECL calculation process, in_particular_reconciliation 
controls over data obtained from different systems; 


- Periodic review and approval of the criteria and thresholds (both 
uantitative and qualitative ones) are established for the 
assessment of significant increase in credit risk (“SICR”) includin 
transfer into or out of the SICR categories to ensure appropriate 
determination of changes in credit risk; 


- Systems and controls are put in place to ensure exposures are 
properly assessed for SICR (whether transfer into or out of the 
SICR categories) in accordance with the defined criteria and 
thresholds. Override cases should be infrequent. If they occur, 
they should be supported by sound justification, and reviewed and 
approved by the appropriate level of authority; and 


- Regular reviews are conducted by the Al’s management on the 
determination of asset quality under HKFRS 9 and that under the 
HKMA’s five-grade loan classification system to ensure no bias in 


the conclusions about the Al’s asset quality and the level of ECL 
allowances made. 
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